论文标题
Cycleganwm：一种自行车水印方法用于所有权验证
CycleGANWM: A CycleGAN watermarking method for ownership verification
论文作者
论文摘要
由于深度神经网络（DNN）的扩散和广泛使用，其知识产权（IPR）保护变得越来越重要。本文介绍了一种新型的模型水印方法，用于无监督的图像到图像翻译（I2IT）网络，该网络名为Cyclean，它利用了图像翻译的视觉质量和水印嵌入。在这种方法中，最初对水印解码器进行了训练。然后将解码器冷冻，并在训练Cyclean水印模型时用于提取水印位。自行车水印（CycleganWm）经过特定的损失功能的训练，并进行了优化，以在I2IT任务和水印嵌入方面具有良好的性能。为了进行水印验证，该工作使用统计显着性测试来从提取物水印位中确定模型的所有权。我们通过在提取水印位之前对模型进行微调来评估模型对图像后处理的鲁棒性，并通过对输出图像进行微调来改进。我们还在模型的黑盒访问下进行替代模型攻击。实验结果证明了所提出的方法对某些图像后处理是有效且鲁棒的，并且能够抵抗替代模型攻击。
Due to the proliferation and widespread use of deep neural networks (DNN), their Intellectual Property Rights (IPR) protection has become increasingly important. This paper presents a novel model watermarking method for an unsupervised image-to-image translation (I2IT) networks, named CycleGAN, which leverage the image translation visual quality and watermark embedding. In this method, a watermark decoder is trained initially. Then the decoder is frozen and used to extract the watermark bits when training the CycleGAN watermarking model. The CycleGAN watermarking (CycleGANWM) is trained with specific loss functions and optimized to get a good performance on both I2IT task and watermark embedding. For watermark verification, this work uses statistical significance test to identify the ownership of the model from the extract watermark bits. We evaluate the robustness of the model against image post-processing and improve it by fine-tuning the model with adding data augmentation on the output images before extracting the watermark bits. We also carry out surrogate model attack under black-box access of the model. The experimental results prove that the proposed method is effective and robust to some image post-processing, and it is able to resist surrogate model attack.
